SOA-C02 Question 23
Select 2A company wants to monitor failed login attempts from its application logs stored in Amazon CloudWatch Logs. They want to generate an alarm whenever there are more than 5 failed login attempts within a 5-minute period. What steps should the SysOps Administrator take to achieve this?
- A
Create a metric filter in CloudWatch Logs that searches for failed login attempt patterns in the logs.
- B
Create a CloudWatch alarm based on the metric filter to monitor for occurrences greater than 5 within a 5-minute period.
- C
Enable detailed monitoring on the EC2 instance where the application is running.
- D
Use AWS Config to monitor and alert on any configuration changes in the application.
- E
Ensure that the IAM role associated with the application has 'logs:PutMetricFilter' permissions.
Show answer and explanation
Correct answers: A, B
Explanation
To monitor failed login attempts, you need to create a metric filter in Amazon CloudWatch Logs that matches the specific pattern for failed logins. This metric filter will generate a custom metric that can then be used to create a CloudWatch alarm. The alarm will trigger when the failed login attempts exceed the threshold (5 attempts in 5 minutes). Other options, such as enabling detailed monitoring or using AWS Config, are not relevant to this scenario.
- A. Correct.
This is correct. Metric filters allow you to extract specific patterns from log data and create custom CloudWatch metrics, which is essential for tracking failed login attempts.
- B. Correct.
This is correct. After creating the metric filter, you need to set up a CloudWatch alarm to trigger an alert when the failed login attempts exceed the defined threshold within the specified period.
- C. Incorrect.
This is incorrect. Enabling detailed monitoring on an EC2 instance provides additional metrics such as CPU utilization, but it is not related to filtering logs or generating alarms based on log data.
- D. Incorrect.
This is incorrect. AWS Config is used for monitoring and recording configuration changes, which is unrelated to monitoring application log patterns or creating alarms for failed login attempts.
- E. Incorrect.
This is incorrect. While ensuring proper IAM permissions is important, 'logs:PutMetricFilter' is not required for the application role. The permissions should be associated with the role or user managing the CloudWatch configuration.